Best Of

If you decide to stay with Vanilla, and think you might need help, you'd do well not to be snippy and rude to one of the most helpful and knowledgable volunteers on this forum.

If you didn't understand the response (which was exactly the right one), try asking politely for clarification.

SOLUTION!

@charrondev here is an idea, after studying htmlawed a bit it seems it is quite a little bit achievable rocket science after all.

It turns out I might not need allowed_attributes, because deny_attributes, actually doubles as both allow and deny according to the official documentation. And vanillaHtmlFormatter already begs the setting from config.php

// $Configuration['Garden']['Html']['BlockedAttributes'] = "-data-, -href, -style";

$attributes = c('Garden.Html.BlockedAttributes', 'on*, target, download');

created new settings for config.php

$Configuration['Garden']['Html']['ClassedElements'] = ["a"]; //only link tag is allowed classname
$Configuration['Garden']['Html']['AllowedClasses'] = ["float-left"]; //only float-left will ever be allowed as a classname for any tag
// $Configuration['Garden']['Html']['ExtraAllowedClasses'] = [];

As for anyone's needs for classes, I suggest the spec function be a little smarter like thus. And this allows the user to place all required settings in config.php

//core/class.vanillahtmlformatter.php

//make the spec function smarter and more in line with the Vanilla way of pulling settings from config.php(!??!)
private function spec() {
    static $spec;
    if ($spec === null) {
        $allowedClasses = c('Garden.Html.AllowedClasses', $this->allowedClasses); //<-added (defaults to the hardcoded list in this file)
        $extraAllowedClasses = c('Garden.Html.ExtraAllowedClasses', []); //<-added (defaults to nothing)
        $classedElements = c('Garden.Html.ClassedElements', $this->classedElements); //<-added (defaults to the hardcoded list in this file
        $spec = [];
        // $allowedClasses = implode('|', array_merge($this->allowedClasses, $this->extraAllowedClasses)); //removed
        // foreach ($this->classedElements as $tag) { //<-removed
        $allowedClasses = implode('|', array_merge($allowedClasses, $extraAllowedClasses)); //<-added
        foreach ($classedElements as $tag) { //<-added
            if (!array_key_exists($tag, $spec) || !is_array($spec[$tag])) {
                $spec[$tag] = [];
            }
            if (!array_key_exists('class', $spec[$tag])) {
                $spec[$tag]['class'] = [];
            }
            $spec[$tag]['class']['oneof'] = $allowedClasses;
        }
    }
    return $spec;
}

Cheers. Should this make into a PR?